AWS Identity and Access Management (IAM) enables you to securely control access to AWS services and resources for your users. Using IAM, you can create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources.

Manage IAM users and their access – You can create users in IAM, assign them individual security credentials (in other words, access keys, passwords, and multi-factor authentication devices), or request temporary security credentials to provide users access to AWS services and resources. You can manage permissions in order to control which operations a user can perform.

Manage IAM roles and their permissions – You can create roles in IAM and manage permissions to control which operations can be performed by the entity, or AWS service, that assumes the role. You can also define which entity is allowed to assume the role.

Manage federated users and their permissions – You can enable identity federation to allow existing identities (e.g. users) in your enterprise to access the AWS Management Console, to call AWS APIs, and to access resources, without the need to create an IAM user for each identity.

Protect your AWS environment by using AWS Multi-Factor Authentication (MFA), a security feature available at no extra cost that augments user name and password credentials. MFA requires users to prove physical possession of a hardware or virtual MFA device by providing a valid MFA code.

You can enable your mobile and browser-based applications to securely access AWS resources by requesting temporary security credentials that grant access only to specific AWS resources for a configurable period of time.

Protect your AWS environment by using AWS Multi-Factor Authentication (MFA), a security feature available at no extra cost that augments user name and password credentials. MFA requires users to prove physical possession of a hardware or virtual MFA device by providing a valid MFA code.

AWS has a list of best practices to help IT professionals and developers manage access control without losing flexibility or resiliency. To get a full explanation of IAM best practices, watch the recorded session from re:Invent 2014 (in the box to the right of this paragraph).